Mechanism◆Article
Every model under the same family shares the same encryption key, so blocks captured from one model can be fed back into the weakest family members, which can be jailbroken into outputting the unencrypted raw reasoning blocks.
The vulnerability mechanism: a shared per-family encryption key lets an attacker replay reasoning blocks from strong models into weak family members and jailbreak the latter into decrypting the raw chain of thought. ✦ AI generated
Paper authors (via Hacker News, stolen-thoughts.com) · Simon Willison's Weblog · 2026-08-11 · original ↗
The paper's authors found that every model under the same family used the same encryption key, which meant you could feed those blocks back into the weakest model family members and jailbreak them into outputting the unencrypted raw reasoning blocks!
Read full article ↗excerpt · fair-use quotation
- ·All models in a family share one encryption key.
- ·Blocks from any model decrypt with the same key.
- ·Key applies across strong and weak family members.
- ·Replay strong-model blocks into weaker members.
- ·Jailbreak weak models to leak raw reasoning.
- ·Attack turns family-wide key into a liability.
Around this claim
This moment responds to
explains mechanism → Anthropic, OpenAI, and Google return encrypted chain-of-thought blocks to clients that can be replayed across sessions, users, and models, and a weaker sibling model can be jailbroken to recover the stronger model's hidden reasoning in plaintext.Paper authors (via Hacker News, stolen-thoughts.com) · Simon Willison's Weblogexplains mechanism → Claude Haiku 4.5 was the easiest model to attack, using a simple prompt instructing it to transcribe the reasoning verbatim inside a thinking-copy tag, helped by an assistant-turn-prefix feature that was removed in the 4.6 models.Paper authors (via Hacker News, stolen-thoughts.com) · Simon Willison's Weblogexplains mechanism → Critical Thinking: Encrypted reasoning blocks from frontier API responses can be decoded and ported to different models, sessions, and users, which dramatically improves open models and leaks personal data when shared publicly.AINews host (unattributed editorial) · Latent Spaceexplains mechanism → Critical Thinking: The attack reuses a valid encrypted reasoning block by replaying it into a different request, placing it in an assistant/model turn, and prompting a weaker model to transcribe the attached reasoning.AINews host (unattributed editorial) · Latent Space